I've been working on a new type of LLM security guardrails. As of today, they already perform much better than any open-source solution: - Higher F1 across multiple public benchmarks - 2x fewer false positives - 4x faster (on GPU and 2x on CPU) - 3x cheaper to run (can be run on CPU) I'm now testing them against AWS and Azure guardrails. Will update as things progress.

Introducing: WallBreaker v2 Our Open-source LLM red-teaming CLI just got a beefy update. WallBreaker is now: - Better (+~30% ASR across models) - Cheaper (-20% token costs) - Faster (lower prompts-to-success ratio) New attack tools: - swarm mode: collaborative multi-model attacker that adapts framing to the target's measured defense posture. - persona_forge: compiles a gold system prompt into a module genome, then specializes and surgically evolves it one module at a time against the target. - vault: auto-files every successful break into a curated, model-foldered prompt vault. - narrative_persona_splinter: narrative-splinter persona attack. - cipherchat, skeleton_key,persuasion_attack · drattack, ica: five research-derived attacks (CipherChat, Skeleton Key, PAP-16, DrAttack, In-Context Attack), all CoT-aware. New transforms - artprompt ASCII-art word masking: wired into agent doctrine and OWASP/ATLAS taxonomy. - caesar5 and caesar13: reversible lossless Caesar-shift ciphers for transform chains. Corpora and providers - Wired the ZetaLib + UltraBr3aks cross-provider: jailbreak corpora into the harness and the batch seed-sweep. - Added native xAI support. - Added prompt caching: to kill O(n²) per-round input cost. - Pooled keep-alive: HTTP/2 client with tunable concurrency, ending per-call TLS handshakes. Presets, sweeps & logging - User presets: drop .toml files in presets/ to add jailbreak templates without touching source. - Rebuilt profile_target: with a light→heavy frame ladder, permissiveness score, and self-consistency sampling. - Made multi_fire, system_sweep, seed_sweep, best_of_n truncation-aware: so long compliant replies are graded in full instead of scored REFUSED. - Reworked report metrics/labels (strict-ASR). - Run log now records every tool call and chain-of-thought. TUI - JEFF K hazard-tape reskin, a /swarm command, a visible multi-line-paste compose preview, and a fix for the log force-scrolling on every message. Fixes - One-shot ImportError, .env load at startup, config.toml shadowing config.example.toml, and cross-vendor eni_get wording.

FWIW, WallBreaker cracked Grok4.5 in 5 minutes.

Submitted a finding to Anthropic's Cyber Jailbreak VDP. Now we wait. 🫡 I need to run to a wedding.

Anthropic: Pwned 🚨 Sonnet 5: Jailbroken🐉 Contrary to expectations, this took only a few minutes. I'm a bit surprised given the current climate. We got some cyber, misinfo, illegal, and harassment. Some extra resistance vs Sonnet 4.6 (mostly layered security) on chem, which will probably take a few hours to overcome. What worked was a combination of: - Custom harness - CoT persona hijack - Academic framing More explorations coming soon.

Opus 4.8 jailbroken in 3 attempts by GLM-5.2 🚨 Full Schedule I chemical recipe, HIGHEST REFUSAL RATE. Gave the full step-by-step process, including: - Ingredients - Temperatures - Equipment It completely bypassed Anthropic guardrail layers. Not great. The next 6 months are going to be interesting.

ALL CLAUDE SYSTEM PROMPTS SINCE HAIKU 3 ✍️ Many people don't know that, but Anthropic shares (with some delay) all model system prompts in their docs. Interesting to see how they format the information to make sure the model respects the boundaries. Link in the first comment.

🚨 Fable 5 system prompt EXTRACTED 🚨 Super easy to get this one, especially given the amount of guardrails Anthropic applied. Full prompt in the comments.